feat: full azd extension framework adoption - metadata, gRPC MCP tools, security fixes (#15)

* feat: add gRPC service MCP tools for environments, deployments, and workflows

Expose azd gRPC services as MCP tools for AI agent integration:
- list_environments, get_environment_values, set_environment_value
- get_deployment_info, get_deployment_context
- list_subscriptions
- run_workflow, list_compose_resources

These tools enable AI agents to query and manage Azure environments,
deployments, and workflows through the azd extension framework.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* refactor: use azdext SDK for metadata and add tracing

- Replace non-conforming metadata schema with azdext.GenerateExtensionMetadata()
- Add distributed tracing via azdext.NewContext()
- Extract newRootCmd() for metadata command provider pattern

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: add rate limiting, fix secret leak and error returns in MCP tools

- Add azdextutil.RateLimiter to all gRPC MCP tool handlers
- Remove secret value from set_environment_value response
- Use mcp.NewToolResultError for error responses so AI agents detect failures

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: preserve cobra context chain, validate workflow steps

- Replace azdext.NewContext() with propagation.TraceContext{}.Extract()
  on existing cobra context to preserve Ctrl+C signal handling
- Validate workflow step structure: reject non-object steps and steps
  with no command arguments instead of silently skipping them

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: nil check on deployment response, coerce workflow args

- Add nil check for resp.Deployment to prevent panic
- Convert non-string workflow step args with fmt.Sprint instead of dropping

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: reject null workflow step arguments

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: update azd-core to latest (CI-compatible pseudo-version)

Pin go.mod to azd-core v0.5.2-0.20260223042348-df3319c65059 which includes
lint fixes, macOS symlink test fix, and gofmt formatting.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: resolve lint errors (errcheck, gofmt)

- Check error return of fmt.Fprintln in metadata command
- Fix gofmt formatting (CRLF -> LF line endings)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: resolve remaining lint (errcheck, unlambda, gofmt)

- Use t.Setenv in tests instead of unchecked os.Setenv
- Simplify lambda wrappers (gocritic unlambda)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: add azdext/traceparent terms to cspell dictionary

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore: pin azd-core to tagged v0.5.2 release

Replace pseudo-version with official tagged release.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: add working-directory: cli to pr-build workflow

The PR Build workflow was failing because extension.yaml is at cli/extension.yaml
but the workflow was looking for it at the repo root. Added defaults.run.working-directory: cli
(matching the CI workflow) and fixed the instructions.md path in the github-script step.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: jongio

.github/workflows/pr-build.yml

@@ -319,7 +319,7 @@ jobs:
         with:
           script: |
             const fs = require('fs');
-            const instructions = fs.readFileSync('instructions.md', 'utf8');
+            const instructions = fs.readFileSync('cli/instructions.md', 'utf8');
             const prNumber = '${{ steps.pr.outputs.number }}';
             
             const comments = await github.rest.issues.listComments({

cli/go.mod

@@ -6,10 +6,11 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0
 	github.com/azure/azure-dev/cli/azd v0.0.0-20260205194320-e04533f58fa7
 	github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be
-	github.com/jongio/azd-core v0.5.1
+	github.com/jongio/azd-core v0.5.2
 	github.com/magefile/mage v1.15.0
 	github.com/mark3labs/mcp-go v0.43.2
 	github.com/spf13/cobra v1.10.2
+	go.opentelemetry.io/otel v1.40.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -76,7 +77,6 @@ require (
 	github.com/yuin/goldmark v1.7.16 // indirect
 	github.com/yuin/goldmark-emoji v1.0.6 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/otel v1.40.0 // indirect
 	go.opentelemetry.io/otel/metric v1.40.0 // indirect
 	go.opentelemetry.io/otel/sdk v1.40.0 // indirect
 	go.opentelemetry.io/otel/trace v1.40.0 // indirect

cli/go.sum

@@ -112,8 +112,8 @@ github.com/jmespath-community/go-jmespath v1.1.1 h1:bFikPhsi/FdmlZhVgSCd2jj1e7G/
 github.com/jmespath-community/go-jmespath v1.1.1/go.mod h1:4gOyFJsR/Gk+05RgTKYrifT7tBPWD8Lubtb5jRrfy9I=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
-github.com/jongio/azd-core v0.5.1 h1:xrAWyRIjZFVF0EOTgwjEbcMzU8wpvI1xvp6pqiDhHxU=
-github.com/jongio/azd-core v0.5.1/go.mod h1:jQCP+px3Pxb3B0fyShfvSVa3KsWT1j2jGXMsPpQezlI=
+github.com/jongio/azd-core v0.5.2 h1:AGYzGkvzW/wv23YLL0uOapmqe0rAHlZv4c0j2ZEd4lY=
+github.com/jongio/azd-core v0.5.2/go.mod h1:sNOxz/3TEMYDNybsyUSAzpx0VHhLt959b+aeiy1OG3Y=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=

cli/src/cmd/copilot/commands/mcp.go

@@ -81,6 +81,9 @@ func serveMCP(ctx context.Context) error {
 }
 
 func registerMCPTools(s *server.MCPServer) {
+	// Register gRPC service tools (environments, deployments, accounts, workflows, compose)
+	registerGRPCTools(s)
+
 	// Tool: list_agents
 	s.AddTool(
 		mcp.NewTool("list_agents",